# Store the real token through a workload identity/agent rendered file. Never commit it.
VAULT_ADDR=https://vault.service.consul:8200
VAULT_TOKEN=replace-with-short-lived-transit-policy-token
VAULT_CACERT=/run/secrets/vault-ca.pem